According to monitoring by Hyperinsight, Zcash (ZEC) has been rocked by an Orchard zero-knowledge proof vulnerability that theoretically allows infinite minting of undetectable fake coins. The negative sentiment began to erupt on the evening of June 4, triggering panic selling. On the Hyperliquid decentralized derivatives platform, ZEC perpetual contract open interest has plummeted from a peak of approximately $371.8 million on June 3 to $180 million at press time—a three-day drop of 51.6%. Notably, around $145 million in positions were unwound early, even before full details of the flaw were publicly disclosed, signaling that large capital reacted much faster than retail traders to the looming risk.
Open Interest Data Reveals Rapid Deleveraging of Leveraged Funds
The open interest movement on Hyperliquid, measured in Beijing time, vividly illustrates the unfolding drama:
Between May 29 and 30, 08:00, OI stood at roughly $223 million, reflecting a calm market. From May 30 to June 3, 08:00, OI surged to a peak of $371.8 million, while the spot price of ZEC climbed from around $530 to $630, showing a classic volume-price rally driven by bullish expectations. By June 3 to June 4, 08:00, the price was still consolidating around $630, but OI had already shrunk dramatically to $226 million—a near 40% decline from the top. As details of the vulnerability filtered out, OI continued to slide to the current $180 million, wiping out over $190 million in notional value from the peak.
Most striking is that during the early hours of June 3 to June 4, while the vulnerability details remained semi-confidential and no widespread panic had yet set in, approximately $145 million in positions were already closed. This exit represented nearly 39% of the peak OI and strongly suggests that well-informed large players detected the danger and chose to exit while liquidity was still ample at elevated price levels.
Complete Timeline: From Private Report to Public Crisis
The sequence from vulnerability discovery to market ignition unfolded as follows (all times Beijing):
Late night May 29 to early May 30: Security researcher Taylor Hornby privately reported the Orchard circuit flaw to the Zcash core team, which confirmed the issue and began drafting a fix.
Evening of May 31: The team initiated confidential coordination with miners and major exchanges to prepare for emergency upgrades.
June 2, 10:00 AM: An emergency soft fork was activated, halting all Orchard transactions to mitigate potential exploitation.
June 3, 12:05 PM: The NU6.2 hard fork went live, officially patching the bug and re-enabling Orchard functionality. However, the accompanying emergency upgrade notice did not fully disclose the severity of the flaw.
From the evening of June 4 onward: As the community and officials gradually released more technical details, the market finally grasped the catastrophic implications. Although the patch was in place, the revelation that the vulnerability had existed for four years shattered holder confidence, and panic intensified over the next two days, directly fueling the OI collapse.
Four-Year ‘Black Box’ Risk and Supply Uncertainty
Orchard serves as Zcash’s core zero-knowledge circuit, ensuring transaction privacy. The disclosed flaw has been present for as long as four years, enabling a theoretical attacker to mint unlimited ZEC without leaving on-chain traces. Due to the anonymous nature of the shielded pool, even external audits cannot confirm with 100% certainty whether the exploit has ever been used. As it stands, the vulnerability remains a “black box”—if it were indeed exploited, the actual circulating supply of ZEC would be thrown into doubt, potentially undermining the coin’s scarcity premise entirely.
From a market perspective, the $145 million early exit highlights the informational advantage of institutional capital. When project disclosures lag behind internal awareness, retail traders are often forced to follow the big money's selling, amplifying a cascade of panic. In the governance of privacy-focused projects, balancing security incident response with transparency remains a deep-seated challenge for Zcash.